Privacy Policy

I. Definitions

1. "Personal data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to that natural person.
2. "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, alignment or combination, restriction, erasure or destruction.
3. "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
4. "Recipient" means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.

II. General Information

1. Controller for data processing

Zerocom GmbH
Robert Zessack (Managing Director)
Nelkenstr. 9
52134 Herzogenrath
Germany
Phone: +49 2406 9950007
Email: [email protected]

2. Legal bases

We process personal data on the basis of at least one of the following legal bases:

• Consent of the data subject (Art. 6(1)(a) GDPR)
• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)
• Compliance with a legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

In this privacy policy, we indicate the respective legal basis for individual processing operations.

3. Disclosure of data to recipients

We disclose personal data to recipients only to the extent necessary and only under one of the following conditions:

• The data subject has consented to the disclosure;
• the disclosure serves the performance of contractual obligations;
• we are legally obliged to disclose the data;
• the disclosure is based on legitimate interests.

4. Third countries

The transfer of personal data to a country outside the EU/EEA only takes place in accordance with Art. 44 et seq. GDPR, i.e. where an adequacy decision exists (Art. 45 GDPR), appropriate safeguards are in place (Art. 46 GDPR) or binding corporate rules apply (Art. 47 GDPR).

5. Data subject rights

As a data subject, you have the following rights:

• Access (Art. 15 GDPR) – to your personal data processed by us
• Rectification (Art. 16 GDPR) – of inaccurate or incomplete data
• Erasure (Art. 17 GDPR) – of your data stored by us, provided no statutory retention obligations apply. In your account, you can initiate this yourself under "Delete account".
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) – you can download your data in a structured format
• Objection (Art. 21 GDPR) – to the processing of your data, where grounds relating to your particular situation exist
• Withdrawal of consent (Art. 7(3) GDPR) – at any time with effect for the future
• Lodge a complaint with a supervisory authority (Art. 77 GDPR) – generally the authority of your place of residence or our registered office

To exercise your rights, please contact us using the contact details provided above.

6. Erasure and retention of personal data

Personal data will be deleted as soon as the purpose of processing no longer applies and no statutory retention obligations exist. Commercial and tax law retention periods amount to up to 6 years (§ 257(1) Nos. 2, 3 HGB; § 147(1) Nos. 2, 3, 5 AO) or 10 years (§ 257(1) Nos. 1, 4 HGB; § 147(1) Nos. 1, 4, 4a AO). During the retention period, processing is restricted in accordance with Art. 18 GDPR.

7. Cookies

Deplyd uses the following cookies:

• Session cookie – to maintain your session after login. Deleted at the end of the session.
• Language setting – to store your selected language (DE/EN).

No tracking, analytics or advertising cookies are set. The technically necessary cookies are based on Art. 6(1)(f) GDPR (legitimate interest in a functioning platform).

You can configure your browser to prevent cookies from being stored. However, this may result in not being able to use all features.

III. Individual processing operations

1. Hosting

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes personal data on our behalf on the basis of a data processing agreement (DPA) pursuant to Art. 28 GDPR. All data is stored exclusively in German data centres.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure provision).

2. Access data and log files

When accessing our platform, your browser automatically sends information to our server, which is stored in log files:

• IP address of the requesting device

• Date and time of access

• Name and URL of the accessed page

• Website from which access was made (referrer URL)

• Browser and operating system used

This data is processed to provide the platform, ensure system security and for anonymised statistical evaluation. Log files are deleted after 14 days at the latest. Under no circumstances is the collected data used to draw conclusions about a person.

Legal basis: Art. 6(1)(f) GDPR.

3. Registration and user account

During registration, we collect:

• Name

• Email address

• Password (stored exclusively as a cryptographic hash)

During use, you store changelog data yourself (projects, entries, webhooks, API keys). This data is processed exclusively to provide the service.

Your data is stored until you delete your user account or instruct us to do so.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

4. Payment processing (Stripe)

For the processing of paid plans, we use the payment service provider Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA. When subscribing, the following data is transmitted to Stripe:

• Email address

• Selected plan and payment interval

• Payment data (credit card, SEPA, etc.) – these are stored exclusively by Stripe and are not accessible to us

Stripe is certified under the EU-U.S. Data Privacy Framework and processes data in accordance with its own privacy policy.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Further information: Stripe Privacy Policy.

5. Email delivery

We send emails in connection with registration (email verification), password resets and subscriber notifications for new changelog entries. Email delivery is handled via Brevo (Sendinblue GmbH, Germany), with which a data processing agreement is in place.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(a) GDPR (consent for subscriber notifications).

6. Changelog widget

Deplyd provides an embeddable JavaScript widget that can be integrated into our users' websites. When the widget loads, the end user's IP address and basic access data (browser, timestamp) are technically transmitted to our servers. This data is processed anonymously for statistics (widget views, page views) and is not used to identify individuals.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the functionality of the service).

7. Data backup (backups)

To ensure data integrity, regular encrypted backups are created and stored on a Hetzner Storage Box in Germany. Backups are automatically rotated and deleted after 14 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data security).

IV. No use of tracking and advertising services

Deplyd uses no analytics, tracking or advertising services such as Google Analytics, Google Ads, Facebook Pixel or comparable services. No user profiles are created and no data is transmitted to advertising networks.